ILS-2139 Conditional rbac for subjectreviews and tokenaccessreviews by Michal-Szczygiel · Pull Request #1088 · IBM/ibm-licensing-operator

Michal-Szczygiel · 2026-05-15T12:17:49Z

Description

Conditional rbac for subjectreviews and tokenaccessreviews

Parent issue

Type

What types of changes does your code introduce?
Put an x in the boxes that apply

Bugfix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Feature change (non-breaking change which modifies existing functionality)
Dependency/version upgrade/CVE remediation
Velocity-improvement (enhancing testing strategy, tidy code, CICD update)

Extra information

I have added tests that prove my fix is effective or that my feature works
I have added the necessary documentation (if appropriate)
Lint and unit tests pass locally with my changes
Tester is needed
This change requires a documentation update - create separate issue with input for doc team

Testing

Manual tests
Automated sert tests:
Before merging your PR, ensure Jenkins tests pass by following these steps:

Run the tests on the clustered environment (OCP/IKS depending on the content of the pull request) using Jenkins pipelines.
If the build fails due to being unstable, restart it.
If the failure is due to other issues unrelated to the tests themselves, address the underlying problem before proceeding.

Test images for further QA testing (if applicable):

Michal-Szczygiel · 2026-06-01T14:05:05Z

Build for these changes passes, take a look at this PR: #1102

dpermus-ibm

please check the kubeRBACAuthEnabled which should default to false

Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com>

…or-subjectreviews-and-tokenaccessreviews

@NorbertKoziana

* ILS-2136 Optional node capping (#1076) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Apply suggestion from @NorbertKoziana Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Corrections --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * ILS-2139 Conditional rbac for subjectreviews and tokenaccessreviews (#1088) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Revert helm charts * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Conditional envvars setting --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * ILS-2140 Conditional support and RBAC for OperandRequests (#1091) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Move configuration to features section in CR * Revert helm charts * Revert helm charts * Revert helm charts 2 * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Fix comments * Fx linter issue * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Remove remaining changes from helm charts * Exit with error when listing IBMLicensing CR-s fails * Conditional envvars setting --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * ILS-2141 Conditional namespace discovery and RBAC (#1092) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Initial implementation * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Move configuration to features section in CR * Rebundle * Change ns discovery configuration * Revert helm charts * Revert helm charts * Revert helm charts * Revert helm charts 2 * Revert helm charts 2 * Run make audit, add support for uv (python deps) * Fix failing tests * Fix failing tests * Fix review issue spotted by IBM Bob * Fix review issue spotted by IBM Bob * Refresh manifests and .secrets.baseline * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Fix comments * Fx linter issue * Fix comments, enable installation of yamlling with uv * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Remove remaining changes from helm charts * Exit with error when listing IBMLicensing CR-s fails * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Update watchedNamespaces field description * Refresh .secrets.baseline * Remove KUBE_RBAC_AUTH_ENABLED diplication * Remove watchedNamespaces field from CR * Update .features.nssEnabled CR field description * Conditional envvars setting * Adjust tests for KUBE_RBAC_AUTH_ENABLED and NODE_CPU_CAPPING_ENABLED envvars * Adjust tests for KUBE_RBAC_AUTH_ENABLED and NODE_CPU_CAPPING_ENABLED envvars * Regenerate manifests --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Refresh .secrets.baseline * ILS-2352 Helm charts - phase 1 (#1108) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Initial implementation * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Move configuration to features section in CR * Rebundle * Change ns discovery configuration * Revert helm charts * Revert helm charts * Revert helm charts * Revert helm charts 2 * Revert helm charts 2 * Run make audit, add support for uv (python deps) * Fix failing tests * Fix failing tests * Fix review issue spotted by IBM Bob * Fix review issue spotted by IBM Bob * Refresh manifests and .secrets.baseline * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Fix comments * Fx linter issue * Fix comments, enable installation of yamlling with uv * Initial helm chart generator implementation * Update helm CRD * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Remove remaining changes from helm charts * Exit with error when listing IBMLicensing CR-s fails * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Update watchedNamespaces field description * Refresh .secrets.baseline * Remove KUBE_RBAC_AUTH_ENABLED diplication * Remove watchedNamespaces field from CR * Update .features.nssEnabled CR field description * Conditional envvars setting * Apply fixes after config changes * Conditional ClusterRole application * Remove comments * Helm charts - branches simplification * Fix Markdown files formatting * Remove generated files and comments * Remove generated files and comments 2 * Remove comment about deletion - no context outside of PR * Remove ILS-2352 references * Move helm generator to separate branch * Remove unused GIT_BRANCH var * Try fixing mdl issues * Adjust mdl configuration to accept ordered lists * Exclude 'MD034 Bare URL used' rule added to mdl config * After review fixes --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Move permisions for getting and listing of ibmlicensingdefinitions (and similar) back to clusterRole * Rebundle * ILS-2412 Update RBAC in helm no operator (#1111) * Copy rbac resources from main chart * Fix error * Rename files for consistency with main chart * Update generation scripts * Update RBAC in helm no operator * ILS-2431 WATCH_NAMESPACE: add whitespace trimming and deduplication (#1115) * Implement whitespace trimming and deduplication * Reformat --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2426 ClusterRole: conditional rule for IBMLicensing custom resources (#1113) * Add PodAnnotationsOverrideEnabled flag to IBMLicensing CRD * Add PodAnnotationsOverrideEnabled flag to IBMLicensing CRD * Flag rename * Conditional clusterRole rule from LS custom resources * Update crd.yaml * Add tests for CUSTOM_RESOURCES_ENABLED envvar * Deply additional License Service custom resources only when customResourcesEnabled=true --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2430 Role and roleBindings auto-creation (#1117) * Auto-apply roles and roleBindings in watched namespaces * Remove rename templates from helm-no-operator * Auto-apply roles and roleBindings in watched namespaces - helm-no-operator * Remove .bob catalog * Update generation script * Remove bob pre-commit hook * Add newline * Add createRBACInWatchedNamespaces helm flag * Remove bob hook * Apply fixes after review comments * Update helm-no-operator/README.md * Use IBM Bob to generate hel chart resoources * Refactor helm templates --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2484 Add support for custom resources switch in helm no operator (#1118) * Auto-apply roles and roleBindings in watched namespaces * Remove rename templates from helm-no-operator * Auto-apply roles and roleBindings in watched namespaces - helm-no-operator * Remove .bob catalog * Update generation script * Remove bob pre-commit hook * Add newline * Add createRBACInWatchedNamespaces helm flag * Remove bob hook * Apply fixes after review comments * Update helm-no-operator/README.md * Use IBM Bob to generate hel chart resoources * Refactor helm templates * Add support for CUSTOM_RESOURCES_ENABLED env var * Update bob prompt so that it obvious what is the source and what is the destination --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2485 Create operator roles in watched namespaces (#1119) * Create operator roles in watched namespaces * Add rules for the opreq * Quote WATCH_NAMESPACE --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * Remove ClusterRoleBindings for prometheus (#1120) Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> Co-authored-by: Norbert Koziana <norbert.koziana@ibm.com>

@NorbertKoziana

* ILS-1821 Major dependencies upgrade (#1041) * Upgrade plan * Dependencies summary * Upgrade plan - update * Phase 1 completed * Phase 1 completed * Phase 2 & 3 completed * Phase 4 completed * Refresh .secrets.baseline * Phase 5 completed * Fix linter issues * Fix linter issues * Install build tools in local bin folder * Fix logging format * Fix manifest generation * Fix exceeding annotations length limit error * Set minKubeVersion to 1.24 * Fix failing unit-test (TestGetLicensingOperatorGroupInNamespace) * Adjust rhmp operator and odlm versions in unit-tests * Use local temp catalog * Check RHMP operator status * Reconcile loop update * Fix string/Schema comparison bugs * Regenerate manifests & linting * Refactor tools installation * Update previously ommited build tools * make bundle regenerates all required yaml-s * Adjust golangci-lint configuration * Small adjustments * Fix caching issue * Remove upgrade history md files * Fix ibm-license-service-cert not found err * Properly detect operator managed resources created before operator upgrade * Set instance name for tests to 'instance' * mdl and hadoolint added * Do not use hadoolint - GPL license * Regenerate manifests after merge with master * CONTRIBUTING.md updated, referencec to diffutils removed * Remove files from temp * Change 2023 -> 2026 in freshly modified files * Correct project README * Use already defined const for release label * Correct PROJECT file * Reduce CRD-s size * Remove duplications from ibm-licensing-operator.clusterserviceversion.yaml * getScheme function refactored * Generate CRD schema for LicensingPods field in IBMLicensingStatus --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-1852 Ingress to gateway migration (#1045) * Upgrade plan * Dependencies summary * Upgrade plan - update * Phase 1 completed * Phase 1 completed * Phase 2 & 3 completed * Phase 4 completed * Refresh .secrets.baseline * Phase 5 completed * Fix linter issues * Fix linter issues * Install build tools in local bin folder * Fix logging format * Fix manifest generation * Fix exceeding annotations length limit error * Set minKubeVersion to 1.24 * Fix failing unit-test (TestGetLicensingOperatorGroupInNamespace) * Adjust rhmp operator and odlm versions in unit-tests * Use local temp catalog * Check RHMP operator status * Reconcile loop update * Fix string/Schema comparison bugs * Regenerate manifests & linting * Refactor tools installation * Update previously ommited build tools * make bundle regenerates all required yaml-s * Adjust golangci-lint configuration * Small adjustments * Fix caching issue * Remove upgrade history md files * Fix ibm-license-service-cert not found err * Properly detect operator managed resources created before operator upgrade * Set instance name for tests to 'instance' * mdl and hadoolint added * Do not use hadoolint - GPL license * Regenerate manifests after merge with master * CONTRIBUTING.md updated, referencec to diffutils removed * Remove files from temp * Change 2023 -> 2026 in freshly modified files * Correct project README * Use already defined const for release label * Correct PROJECT file * Reduce CRD-s size * Remove duplications from ibm-licensing-operator.clusterserviceversion.yaml * getScheme function refactored * Generate CRD schema for LicensingPods field in IBMLicensingStatus * added gateway and handling secrets issue * fixes * tests fixes * formatting * formating issues * fixes and merge with Michals branch Signed-off-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> * Hardcode Gateway API resource names for consistency Signed-off-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> * fixes * fixes * fixes * fixes * removed redundant lines in customization * fixed go sum and removed externals crds * Remove duplicate block in ibmlicensing_controller.go * Regenerate manifests * Fix review issues considered to be high severity * Fix review issues considered to be medium severity * Fix review issues considered to be medium severity * Fix review issues considered to be low severity * Remove marketplace.redhat.com_meterdefinitions.yaml * Tests for gateway API resources reconciliation added * make bundle audit lint * Install gateway API CRD-s in CI tests * make bundle audit lint * Move backendtlspolicies, gateways, httproutes to Role * Add expected Requeue: true to reconcile.Result-s * Remove unnecessay annotations overwrite * Change context type for tests * Increase test timeout to 30 min * Asert on proper labels in tests * Explicitly set groups for gateway resources * Remove LLM comment, make bundle audit lint --------- Signed-off-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> * ILS-2015 set "..bundle.package.v1" annotation to "ibm-licensing-operator-app" (#1061) * Set annotation with yq --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2074 Cache gateway resources only in operator namespace (#1063) * Cache gateway resources only in operator ns * Check for CRD-s before setting cache * Exist with status = 1 after k8s API check failure * Refactoring --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2033 Refresh annotations on change (#1059) * Refresh annotations on change * Apply suggestion from @NorbertKoziana Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * After review fixes * Remove Bob pre-commit hook --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * ILS-1896 Fix installing LS from custom catalog image (#1060) * ILS-2085 Add development helm charts build (#1069) * Initial commit based on UMS implementation * Remove non cluster scoped charts * Add building helm charts for other components as well * Use bash to reduce duplication * Adjust code to publish cluster scoped helm charts separately * Adjust dev helm charts destination * Adjust pipeline config for tests * Move new code to the bottom in makefile * Code refactor * Test build * Rename yq_key_prefix * Fix setting scanner images * Code refactor * Fix misleading comment * fix grammar * use git-commit var (#1071) Co-authored-by: Karol Matoga <Karol.Matoga@ibm.com> * ILS-1978-Add-master-switch-for-gateway-api-logs (#1062) * initil commit added ocp field switch * using flag everywhere * added separated func for handling checking GatewayOptions and EnableGatewayAPIOpenshift * changes according to review * handling logs flag on non ocp cluster * removed v3 channel --------- Co-authored-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> * ILS-2117 Pretty print images in SPS build pipeline (#1070) * Add image printing section to PR and CI pipelines * Change image logging logic * Add newline * Fix syntax err * Remove unneccessary comments * Remove unused target * Remove unused target 2 * Trigger * Revert trigger * Tag operator image with branch name --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * Build catalog images for develop branches (#1073) * Build catalog images for develop branches Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Add missing git branch tag Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update bundle builds Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Delete redundant config updates Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> --------- Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Merge master to develop (#1077) * ILS-2074 Cache gateway resources only in operator namespace (#1063) (#1066) * ILS-2074 Cache gateway resources only in operator namespace (#1063) * Cache gateway resources only in operator ns * Check for CRD-s before setting cache * Exist with status = 1 after k8s API check failure * Refactoring --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * bump go to 1.26.2 * Version bump to 4.2.22 - LS only --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: Karol Matoga <Karol.Matoga@ibm.com> * ILS-2109 Run DiscoverOperandRequests only when Operator Group CRD-s extist (#1068) * Run DiscoverOperandRequests only when Operator Group CRD-s extist * Fix spelling mistake * Fix spelling mistake 2 --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * Trigger build with new base image * Version bump to 4.2.23 (#1074) Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: Karol Matoga <Karol.Matoga@ibm.com> Co-authored-by: SPS Build <cicdpriv@us.ibm.com> * Remove minKubeVersion label (#1079) Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * upgraded helm chart version and appVersion based on CPD request (#1084) * Add branch tag to catalogsource image (#1080) * Add branch tag to catalogsource image Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update image tagging Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update catalogsource branch tag Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Add debug logs Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Delete debug logs Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Fix image tagging to use actual branch name instead of develop Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Delete overriding envs Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update VSC Ref Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> --------- Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Add possibility to skip RBAC install (#1075) * Add possibility to skip RBAC install Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Delete flag from CR Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update flag checking Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Add missing spaces Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update rbac checking Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update values Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update deployments Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update values Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update deployments Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Update createRBAC flag checks Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Add deployments to helm templates Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> --------- Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Ils-2171 add missing metadata and description (#1083) * Add missing metadata to helm-migration Chart.yaml and package chart * Regenerate helm-charts with correct URL for current branch * Update Chart.yaml with extended description and regenerate helm-charts * Remove helm-charts directory - keep only Chart.yaml with metadata * Update Chart.yaml with official IBM Licensing Operator README * Update artifacthub.io/readme with full content including migration instructions * Remove index.yaml - will be generated during release * Remove appVersion from Chart.yaml Removed appVersion field from Chart.yaml. --------- Co-authored-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> * ubi10 adoption (#1085) Co-authored-by: Karol Matoga <Karol.Matoga@ibm.com> * remediate vulns (#1090) Co-authored-by: Karol Matoga <Karol.Matoga@ibm.com> * Restructure of ArgoCD instructions (#1053) * ILS-1938 --------- Co-authored-by: Michał Paluch <michal.paluch@pl.ibm.com> * icon reference with base64 encoded image to support airgapped deployments (#1096) * Add branch checks for ci pipeline (#1095) * Add branch checks for ci pipeline Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Delete helm charts creating from ci pipeline for master Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * Fix comments Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> --------- Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * ILS-2244-Extend-SPS-build-with-migration-charts (#1098) * ILS-2244-Extend-SPS-build-with-migration-charts Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * revert changes in build helm script Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> --------- Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> * ILS-2143 Helm charts no operator (#1101) * Add plan.md * Update installation method in plan.md * Improve plan with section about secrets * Review and improve plan * Backup old plan before changing the approach * Fix bug in route * Add required_resources.md * Add generating yaml files in reconcile loop * Add kubectl neat to extracting resources from cluster * Update go.mod * Save generated yaml files * move script file * Add yaml files for resources created by operator * Add rbac files * Add chart structure * Add secrets templating * Add deployment templating * Add route and service templating * Add rbac templating * Remove tls from route * Improve extracting resources from cluster * Adjust values.yaml * Adjust extracting ang generating yaml files * Fix templating prometheus env var * Rename extract script * Clean up resources folder * Remove unused CRD * Revert changes in controller * Remove unsued code * Remove kubectl neat * Add readme and standarize logging in scripts * Refactor build-helm-chart * Update extract cluster resouces * Refactor logging * Refactor bash scripts * Remove md files * Refactor chart.yaml and values.yaml * Regenerate charts * Refactor values.yaml * Remove route from templates * Fix setting image pull secret * Revert changes in route to move them to different PR * Remove duplicate port from init container to avoid warn when installing LS * Refactor scripts readme * Refactor comments and make templating consistent * Satisfy linter * Extract 10 to variable * Adjust readme * Make check_prerequisites and creatings paths consistent * Code refactor * Simplify chart.yaml readme * Fix label on pod * Fix log message * Remove tmp directory from template-resources * Run make audit * ILS-2360 Add support for new env vars in helm charts no operator (#1109) * Add support for new env vars and make values.yaml consistent with standard helm charts * Add better trimming * Adjust code after configuration changes * Fix error in values.yaml * Update default value for namespace scoping * Fix setting watch namespace env var * Group nssEnabled and watchNamespace env vars together * Adjust comment * Group https fields together in values.yaml * Version bump to 4.2.24 (#1112) Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * UMS-next Phase 1 & 2 (#1106) * ILS-2136 Optional node capping (#1076) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Apply suggestion from @NorbertKoziana Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Corrections --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * ILS-2139 Conditional rbac for subjectreviews and tokenaccessreviews (#1088) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Revert helm charts * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Conditional envvars setting --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * ILS-2140 Conditional support and RBAC for OperandRequests (#1091) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Move configuration to features section in CR * Revert helm charts * Revert helm charts * Revert helm charts 2 * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Fix comments * Fx linter issue * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Remove remaining changes from helm charts * Exit with error when listing IBMLicensing CR-s fails * Conditional envvars setting --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * ILS-2141 Conditional namespace discovery and RBAC (#1092) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Initial implementation * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Move configuration to features section in CR * Rebundle * Change ns discovery configuration * Revert helm charts * Revert helm charts * Revert helm charts * Revert helm charts 2 * Revert helm charts 2 * Run make audit, add support for uv (python deps) * Fix failing tests * Fix failing tests * Fix review issue spotted by IBM Bob * Fix review issue spotted by IBM Bob * Refresh manifests and .secrets.baseline * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Fix comments * Fx linter issue * Fix comments, enable installation of yamlling with uv * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Remove remaining changes from helm charts * Exit with error when listing IBMLicensing CR-s fails * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Update watchedNamespaces field description * Refresh .secrets.baseline * Remove KUBE_RBAC_AUTH_ENABLED diplication * Remove watchedNamespaces field from CR * Update .features.nssEnabled CR field description * Conditional envvars setting * Adjust tests for KUBE_RBAC_AUTH_ENABLED and NODE_CPU_CAPPING_ENABLED envvars * Adjust tests for KUBE_RBAC_AUTH_ENABLED and NODE_CPU_CAPPING_ENABLED envvars * Regenerate manifests --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Refresh .secrets.baseline * ILS-2352 Helm charts - phase 1 (#1108) * Initial implementation * Revert clusterRole changes * Correct comment * Cleanup * Initial implementation * Initial implementation * Initial implementation * Move configuration to features section in CR * Move configuration to features section in CR 2 * Move configuration to features section in CR * Rebundle * Change ns discovery configuration * Revert helm charts * Revert helm charts * Revert helm charts * Revert helm charts 2 * Revert helm charts 2 * Run make audit, add support for uv (python deps) * Fix failing tests * Fix failing tests * Fix review issue spotted by IBM Bob * Fix review issue spotted by IBM Bob * Refresh manifests and .secrets.baseline * Fix nil pointer dereference issue * Remove misplaced CR param * Change CRD param description * Fix comments * Fx linter issue * Fix comments, enable installation of yamlling with uv * Initial helm chart generator implementation * Update helm CRD * Update controllers/resources/service/containers_test.go Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Revert remaining changes introduced in helm charts * Revert remaining changes introduced in helm charts 2 * Always emit KUBE_RBAC_AUTH_ENABLED envvar * Change CRD field descriptions * Remove remaining changes from helm charts * Exit with error when listing IBMLicensing CR-s fails * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Use only NAMESPACE_SCOPE_ENABLED envvar in both classic and UMS-next flows * Update watchedNamespaces field description * Refresh .secrets.baseline * Remove KUBE_RBAC_AUTH_ENABLED diplication * Remove watchedNamespaces field from CR * Update .features.nssEnabled CR field description * Conditional envvars setting * Apply fixes after config changes * Conditional ClusterRole application * Remove comments * Helm charts - branches simplification * Fix Markdown files formatting * Remove generated files and comments * Remove generated files and comments 2 * Remove comment about deletion - no context outside of PR * Remove ILS-2352 references * Move helm generator to separate branch * Remove unused GIT_BRANCH var * Try fixing mdl issues * Adjust mdl configuration to accept ordered lists * Exclude 'MD034 Bare URL used' rule added to mdl config * After review fixes --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> * Move permisions for getting and listing of ibmlicensingdefinitions (and similar) back to clusterRole * Rebundle * ILS-2412 Update RBAC in helm no operator (#1111) * Copy rbac resources from main chart * Fix error * Rename files for consistency with main chart * Update generation scripts * Update RBAC in helm no operator * ILS-2431 WATCH_NAMESPACE: add whitespace trimming and deduplication (#1115) * Implement whitespace trimming and deduplication * Reformat --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2426 ClusterRole: conditional rule for IBMLicensing custom resources (#1113) * Add PodAnnotationsOverrideEnabled flag to IBMLicensing CRD * Add PodAnnotationsOverrideEnabled flag to IBMLicensing CRD * Flag rename * Conditional clusterRole rule from LS custom resources * Update crd.yaml * Add tests for CUSTOM_RESOURCES_ENABLED envvar * Deply additional License Service custom resources only when customResourcesEnabled=true --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2430 Role and roleBindings auto-creation (#1117) * Auto-apply roles and roleBindings in watched namespaces * Remove rename templates from helm-no-operator * Auto-apply roles and roleBindings in watched namespaces - helm-no-operator * Remove .bob catalog * Update generation script * Remove bob pre-commit hook * Add newline * Add createRBACInWatchedNamespaces helm flag * Remove bob hook * Apply fixes after review comments * Update helm-no-operator/README.md * Use IBM Bob to generate hel chart resoources * Refactor helm templates --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2484 Add support for custom resources switch in helm no operator (#1118) * Auto-apply roles and roleBindings in watched namespaces * Remove rename templates from helm-no-operator * Auto-apply roles and roleBindings in watched namespaces - helm-no-operator * Remove .bob catalog * Update generation script * Remove bob pre-commit hook * Add newline * Add createRBACInWatchedNamespaces helm flag * Remove bob hook * Apply fixes after review comments * Update helm-no-operator/README.md * Use IBM Bob to generate hel chart resoources * Refactor helm templates * Add support for CUSTOM_RESOURCES_ENABLED env var * Update bob prompt so that it obvious what is the source and what is the destination --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * ILS-2485 Create operator roles in watched namespaces (#1119) * Create operator roles in watched namespaces * Add rules for the opreq * Quote WATCH_NAMESPACE --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> * Remove ClusterRoleBindings for prometheus (#1120) Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> --------- Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> Co-authored-by: Norbert Koziana <norbert.koziana@ibm.com> * Ils 2352 helm no operator conditional extensions (#1121) set of extensions to helm-no-operator chart * remediate vulns (#1122) Co-authored-by: Karol Matoga <Karol.Matoga@ibm.com> * Take base_images.json from master --------- Signed-off-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> Signed-off-by: Kacper-Komenda <Kacper.Komenda@ibm.com> Co-authored-by: Michal Szczygiel <Michal.Szczygiel@ibm.com> Co-authored-by: Bartosz <68814524+LawyerN@users.noreply.github.com> Co-authored-by: Bartosz Gdowski <Bartosz.Gdowski@ibm.com> Co-authored-by: Dariusz Permus <dariusz.permus@ibm.com> Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com> Co-authored-by: KacperKomenda <Kacper.Komenda@ibm.com> Co-authored-by: Karol Matoga <45312091+karol1999@users.noreply.github.com> Co-authored-by: Karol Matoga <Karol.Matoga@ibm.com> Co-authored-by: SPS Build <cicdpriv@us.ibm.com> Co-authored-by: Agnieszka Tkaczyk-Walczak <agnieszka.tkaczyk@pl.ibm.com> Co-authored-by: Michał Paluch <michal.paluch@pl.ibm.com> Co-authored-by: Norbert Koziana <norbert.koziana@ibm.com>

Michal Szczygiel added 6 commits May 7, 2026 14:04

Initial implementation

487556a

Resolve conflicts with develop

32b9a14

Revert clusterRole changes

1394247

Correct comment

3f7d5a2

Cleanup

2c1a09d

Initial implementation

02f39f5

Michal-Szczygiel marked this pull request as ready for review May 15, 2026 12:46

Michal-Szczygiel requested review from NorbertKoziana, dpermus-ibm and karol1999 May 15, 2026 12:46

Base automatically changed from ILS-2136-optional-node-capping to ls-operand-standalone May 15, 2026 14:51

Michal-Szczygiel marked this pull request as draft May 15, 2026 14:53

Michal Szczygiel added 4 commits May 29, 2026 11:56

Move configuration to features section in CR

972b46d

Move configuration to features section in CR 2

f57bf90

Resolve conflicts with ls-operand-standalone

4475eed

Revert helm charts

aad9ee8

Michal-Szczygiel marked this pull request as ready for review June 1, 2026 11:53

Michal-Szczygiel commented Jun 1, 2026

View reviewed changes

Comment thread api/v1alpha1/helper.go Outdated

Michal Szczygiel added 3 commits June 2, 2026 10:42

Fix nil pointer dereference issue

24034f4

Remove misplaced CR param

d0c8fc2

Change CRD param description

101dc3e

NorbertKoziana approved these changes Jun 3, 2026

View reviewed changes

Comment thread controllers/resources/service/containers_test.go Outdated

Comment thread deploy/argo-cd/components/license-service/helm-cluster-scoped/templates/crd.yaml Outdated

Comment thread api/v1alpha1/features.go

dpermus-ibm reviewed Jun 3, 2026

View reviewed changes

Comment thread api/v1alpha1/features.go

Michal-Szczygiel and others added 6 commits June 8, 2026 12:29

Update controllers/resources/service/containers_test.go

892cadc

Co-authored-by: NorbertKoziana <90091855+NorbertKoziana@users.noreply.github.com>

Revert remaining changes introduced in helm charts

1ffec30

Revert remaining changes introduced in helm charts 2

ec11d98

Always emit KUBE_RBAC_AUTH_ENABLED envvar

be79965

Change CRD field descriptions

ef27f6a

Merge branch 'ls-operand-standalone' into ILS-2139-conditional-rbac-f…

e665de2

…or-subjectreviews-and-tokenaccessreviews

NorbertKoziana approved these changes Jun 10, 2026

View reviewed changes

Michal-Szczygiel mentioned this pull request Jun 10, 2026

ILS-2141 Conditional namespace discovery and RBAC #1092

Merged

12 tasks

Conditional envvars setting

743455b

Michal-Szczygiel merged commit 2791e16 into ls-operand-standalone Jun 10, 2026
1 check failed

Michal-Szczygiel deleted the ILS-2139-conditional-rbac-for-subjectreviews-and-tokenaccessreviews branch August 5, 2026 07:59

Navigation Menu

Uh oh!

ILS-2139 Conditional rbac for subjectreviews and tokenaccessreviews - #1088

ILS-2139 Conditional rbac for subjectreviews and tokenaccessreviews#1088
Michal-Szczygiel merged 20 commits into
ls-operand-standalonefrom
ILS-2139-conditional-rbac-for-subjectreviews-and-tokenaccessreviews

Michal-Szczygiel commented May 15, 2026 •

edited

Loading

Uh oh!

Michal-Szczygiel commented Jun 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dpermus-ibm left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Michal-Szczygiel commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Parent issue

Type

Extra information

Testing

Test images for further QA testing (if applicable):

Uh oh!

Michal-Szczygiel commented Jun 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dpermus-ibm left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Michal-Szczygiel commented May 15, 2026 •

edited

Loading

dpermus-ibm left a comment •

edited

Loading